[Security Solution][Detections] Endpoint Exceptions no longer restrict 'file.path.*' fields in field selector #95848
Labels
bug
Fixes for quality problems that affect the customer experience
impact:high
Addressing this issue will have a high level of impact on the quality/strength of our product.
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
v7.13.0
Kibana version:
7.13, 8.0
Elasticsearch version:
7.13, 8.0
Describe the bug:
In the exceptions workflow, when creating an Endpoint Exception, there's no longer a restriction on the
file.path
field. I can see options forfile.path
,file.path.caseless
, andfile.path.text
. Before, there was a restriction on creating exceptions to only acceptfile.path.caseless
Steps to reproduce:
file.path
,file.path.caseless
, andfile.path.text
are all availableExpected behavior:
Users should be restricted to selecting
file.path.caseless
Screenshots (if relevant):
Any additional context:
I noticed that we used to user this helper which pulls in exceptionable fields based on
type: 'endpoint'
: https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/public/common/components/exceptions/builder/helpers.tsx#L15I think this is now being used which doesn't use exceptionable fields JSON: https://github.com/elastic/kibana/blob/master/x-pack/plugins/lists/public/exceptions/components/builder/helpers.ts#L165
The text was updated successfully, but these errors were encountered: